diff options
| -rw-r--r-- | src/fs/seclabelfs/cgroupseclabelfs.cil | 18 | ||||
| -rw-r--r-- | src/misc.cil | 11 |
2 files changed, 13 insertions, 16 deletions
diff --git a/src/fs/seclabelfs/cgroupseclabelfs.cil b/src/fs/seclabelfs/cgroupseclabelfs.cil index d2931b0..18266a1 100644 --- a/src/fs/seclabelfs/cgroupseclabelfs.cil +++ b/src/fs/seclabelfs/cgroupseclabelfs.cil @@ -2,10 +2,18 @@ ;; SPDX-License-Identifier: Unlicense (block cgroup + (filecon "/sys/fs/cgroup" dir fs_context) + (filecon "/sys/fs/cgroup/.*" any ()) - (genfscon "cgroup" "/" fs_context) - (genfscon "cgroup2" "/" fs_context) + (allow fs self (filesystem (associate))) - (blockinherit .fs.macro_template_dirs) - (blockinherit .fs.macro_template_files) - (blockinherit .seclabelfs.template)) + (call .rbacsep.exempt.obj.type (fs)) + + (call .sys.associate_fs (fs)) + + (genfscon "cgroup" "/" fs_context) + (genfscon "cgroup2" "/" fs_context) + + (blockinherit .fs.macro_template_dirs) + (blockinherit .fs.macro_template_files) + (blockinherit .seclabelfs.template)) diff --git a/src/misc.cil b/src/misc.cil index d0d6af4..a537370 100644 --- a/src/misc.cil +++ b/src/misc.cil @@ -3,17 +3,6 @@ (sidcontext init (sys.id sys.role sys.subj sys.lowlow)) ;; userspace_initial_context -(in cgroup - - (filecon "/sys/fs/cgroup" dir fs_context) - (filecon "/sys/fs/cgroup/.*" any ()) - - (allow fs self (filesystem (associate))) - - (call .rbacsep.exempt.obj.type (fs)) - - (call .sys.associate_fs (fs))) - (in conf (filecon "/etc" dir file_context) |